Every answer you find for this error tells you to go set a static machineKey in web.config, with the whole web-farm-and-cluster speech attached. On a real farm that advice is correct. On a single box it sends you down a rabbit hole that has nothing to do with your actual problem, which is exactly where I lived for months before the real cause turned out to be one attribute in the markup.
Here is the yellow screen, pasted in full so anyone searching the exact text lands here instead of losing the same months I did:
Server Error in '/' Application.
Validation of viewstate MAC failed. If this application is hosted by a Web Farm or cluster, ensure that <machineKey> configuration specifies the same validationKey and validation algorithm. AutoGenerate cannot be used in a cluster.
One server. No cluster. machineKey already pinned. Still throwing.
The culprit was the masterpage form:
<form id="form1" action="/" runat="server">
That action="/" is the problem. A server side form is meant to post back to itself, and ASP.NET wires up that target for you. When you hardcode the action you override it, the viewstate gets posted somewhere the framework recomputes the MAC against a different path, and it rejects the whole thing as tampered. Pull the attribute off:
<form id="form1" runat="server">
Works again.
This is ASP.NET behavior, not a Sitefinity quirk, even though Sitefinity is where it bit me. So if your machineKey is already pinned and you are still eating the MAC failure on a single server, close web.config and go read every <form runat="server"> in your masterpages. The hardcoded action is usually sitting right there in markup you inherited and never thought to question.